File Type Identification

• Do not trust the extension. Trust the magic bytes.
• MZ (0x4D5A) at offset 0 → Windows PE/DOS
• PE\textbackslash 0\textbackslash 0 at the PE header offset
• \textbackslash x7FELF → Linux ELF; PK → ZIP / Office / JAR
• Tools: file, TrID, Detect It Easy (DIE), pefile
• Check: 32- vs 64-bit, GUI vs console, compile timestamp, sections